The 2019 Thales Global Cloud Security Study, conducted by the Ponemon Institute, looks at how organizations are securing data in the cloud and where the gaps are. It focuses on:

• What cloud security controls are actually in place across organizations.
• How companies choose their cloud providers from a security and compliance perspective.
• How privacy and data protection regulations are being managed in cloud environments.

The study is relevant because it highlights that many organizations still have major gaps between the level of protection they need and what they currently deploy. It underscores that cloud adoption has outpaced cloud security strategy in many cases, making it important for teams to reassess how they protect sensitive data in the cloud.

The study uncovered several important gaps in how organizations approach cloud security:

• Inconsistent security controls: Many organizations lack a unified approach to securing data across multiple cloud providers and services.
• Provider selection not driven by security: Security and data protection are not always the primary criteria when choosing cloud providers, which can introduce risk.
• Limited focus on privacy and regulations: There are gaps in how organizations manage privacy requirements and comply with data protection regulations once data moves to the cloud.

These findings suggest that organizations need to rethink how they evaluate cloud providers, standardize controls, and align cloud usage with regulatory and privacy obligations.

The report highlights that high-performance data encryption and strong key management are central to achieving adequate protection in the cloud. Specifically, it shows that:

• Encryption helps protect sensitive data even if cloud infrastructure or accounts are compromised.
• Effective key management ensures that organizations, not just providers, control access to encrypted data.
• Performance matters: Encryption and key management must be designed to handle modern workloads without slowing down applications or user access.

By prioritizing robust encryption and disciplined key management, organizations can reimagine their cloud security posture and better align with privacy and data protection requirements highlighted in the study.